forensic-reporting

取证报告

全面的取证报告技能，可用于创建专业的调查报告和文档。可根据取证结果生成技术报告、执行摘要、专家证人文档以及符合合规要求的交付材料。

功能

• 技术报告：生成详细的技术取证报告
• 执行摘要：为管理层撰写高级别摘要
• 专家证人报告：准备可供法庭使用的文档
• 事件报告：生成事件响应报告
• 证据保管链：创建证据处理文档
• 时间线报告：生成以时间线为重点的报告
• IOC 报告：创建失陷指标报告
• 合规报告：生成符合合规要求的文档
• 多格式导出：导出为 PDF、DOCX、HTML、Markdown
• 报告模板：使用可自定义的报告模板

快速开始

from forensic_reporting import ReportGenerator, IncidentReport, TechnicalReport

# Initialize report generator
generator = ReportGenerator(case_id="CASE-2024-001")

# Add findings
generator.add_finding(title="Malware Detected", severity="high", details="...")

# Generate report
report = generator.generate_technical_report()
report.export_pdf("/evidence/reports/technical_report.pdf")

用法

任务 1：技术取证报告

输入：取证结果和分析结果

流程：

1. 梳理调查结果
2. 添加证据引用
3. 包含技术细节
4. 生成可视化内容
5. 导出报告

输出：全面的技术报告

示例：

from forensic_reporting import TechnicalReportGenerator

# Initialize report generator
report = TechnicalReportGenerator(
    case_id="CASE-2024-001",
    case_name="Corporate Network Intrusion",
    examiner="John Doe",
    organization="ACME Security"
)

# Set case details
report.set_case_details(
    date_received="2024-01-15",
    date_completed="2024-01-20",
    requesting_party="ACME Corporation",
    subject="Investigation of suspected network intrusion"
)

# Add evidence items
report.add_evidence(
    item_id="EVD-001",
    description="Memory dump from WORKSTATION01",
    hash_sha256="abc123...",
    acquisition_date="2024-01-15",
    acquisition_method="WinPMEM"
)

report.add_evidence(
    item_id="EVD-002",
    description="Disk image from WORKSTATION01",
    hash_sha256="def456...",
    acquisition_date="2024-01-15",
    acquisition_method="FTK Imager"
)

# Add findings
report.add_finding(
    title="Malware Infection Confirmed",
    severity="critical",
    category="malware",
    description="Analysis confirmed presence of Cobalt Strike beacon",
    evidence_refs=["EVD-001", "EVD-002"],
    artifacts=[
        "C:\\Windows\\Temp\\beacon.exe",
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater"
    ],
    iocs=["203.0.113.50", "evil-c2.example.com"],
    mitre_techniques=["T1059.001", "T1547.001"]
)

report.add_finding(
    title="Credential Access Detected",
    severity="high",
    category="credential_access",
    description="Evidence of Mimikatz execution found in memory",
    evidence_refs=["EVD-001"],
    artifacts=["Process: lsass.exe accessed by unknown process"],
    mitre_techniques=["T1003.001"]
)

# Add timeline
report.add_timeline_event("2024-01-10 10:30", "Initial phishing email received")
report.add_timeline_event("2024-01-10 10:35", "User opened malicious attachment")
report.add_timeline_event("2024-01-10 10:36", "Malware beacon established")
report.add_timeline_event("2024-01-10 14:00", "Credential dumping detected")

# Add analysis methodology
report.add_methodology(
    tools_used=["Volatility 3", "Autopsy", "YARA"],
    techniques=["Memory forensics", "Timeline analysis", "IOC extraction"]
)

# Add conclusions
report.add_conclusion(
    summary="The investigation confirmed a successful intrusion via phishing",
    impact="Critical - credential theft and potential data exfiltration",
    recommendations=[
        "Immediately reset all compromised credentials",
        "Block identified C2 infrastructure",
        "Conduct enterprise-wide threat hunting"
    ]
)

# Generate report
report.generate()

# Export to multiple formats
report.export_pdf("/evidence/reports/technical_report.pdf")
report.export_docx("/evidence/reports/technical_report.docx")
report.export_html("/evidence/reports/technical_report.html")

任务 2：执行摘要

输入：调查结果

流程：

1. 总结关键发现
2. 突出业务影响
3. 提供建议
4. 使用非技术性语言
5. 生成简明报告

输出：面向管理层的摘要

示例：

from forensic_reporting import ExecutiveSummaryGenerator

# Initialize executive summary
summary = ExecutiveSummaryGenerator(
    case_id="CASE-2024-001",
    case_name="Security Incident Investigation"
)

# Set header information
summary.set_header(
    prepared_for="Executive Leadership Team",
    prepared_by="Security Incident Response Team",
    date="January 20, 2024",
    classification="Confidential"
)

# Add executive overview
summary.add_overview("""
On January 10, 2024, the Security Operations Center detected suspicious
activity on WORKSTATION01. An investigation was immediately initiated,
confirming a successful cyber intrusion. The attacker gained initial
access via a phishing email and subsequently stole credentials.
""")

# Add key findings
summary.add_key_finding(
    title="Confirmed Security Breach",
    description="An attacker successfully compromised corporate systems",
    impact="High - credential theft confirmed"
)

summary.add_key_finding(
    title="Attack Duration",
    description="The attacker maintained access for approximately 4 hours",
    impact="Medium - limited time window reduced exposure"
)

# Add business impact
summary.add_business_impact(
    affected_systems=["WORKSTATION01", "Potentially others"],
    data_at_risk="Employee credentials, potentially sensitive documents",
    operational_impact="Minimal - contained before widespread damage",
    financial_impact="Estimated $50,000 for incident response and remediation",
    regulatory_impact="Possible notification requirements under GDPR"
)

# Add recommendations
summary.add_recommendation(
    priority="immediate",
    action="Reset all credentials for affected users",
    owner="IT Security",
    timeline="Within 24 hours"
)

summary.add_recommendation(
    priority="short_term",
    action="Implement additional phishing protections",
    owner="IT Security",
    timeline="Within 2 weeks"
)

summary.add_recommendation(
    priority="long_term",
    action="Deploy endpoint detection and response solution",
    owner="IT Infrastructure",
    timeline="Within 90 days"
)

# Add metrics/KPIs
summary.add_metrics(
    detection_time="30 minutes",
    containment_time="4 hours",
    investigation_duration="5 days"
)

# Generate and export
summary.generate()
summary.export_pdf("/evidence/reports/executive_summary.pdf")
summary.export_pptx("/evidence/reports/executive_presentation.pptx")

任务 3：专家证人报告

输入：用于法律诉讼的取证分析

流程：

1. 记录资质
2. 描述方法
3. 客观呈现调查结果
4. 使用准确的措辞
5. 做好接受交叉询问的准备

输出：可供法庭使用的专家报告

示例：

from forensic_reporting import ExpertWitnessReport

# Initialize expert witness report
report = ExpertWitnessReport(
    case_number="CV-2024-12345",
    court="United States District Court",
    jurisdiction="Northern District"
)

# Add expert qualifications
report.add_expert_qualifications(
    name="Dr. Jane Smith",
    title="Senior Digital Forensics Examiner",
    organization="Forensic Experts Inc.",
    qualifications=[
        "Ph.D. in Computer Science, specializing in Digital Forensics",
        "20+ years experience in digital forensic investigations",
        "Certified: EnCE, GCFE, CFCE",
        "Published author of 15 peer-reviewed papers on digital forensics"
    ],
    prior_testimony=[
        "Qualified as expert in federal and state courts 50+ times",
        "Testified in matters involving computer intrusion, fraud, IP theft"
    ]
)

# Add scope of engagement
report.add_engagement_scope(
    retained_by="Plaintiff",
    engagement_date="January 15, 2024",
    scope="""
    I was retained to examine digital evidence and provide expert opinion on:
    1. Whether the defendant's computer systems were used to access
       plaintiff's proprietary information
    2. The timing and extent of any unauthorized access
    3. Actions taken to conceal such access
    """,
    materials_reviewed=[
        "Forensic image of defendant's laptop (Evidence Item A)",
        "Server access logs from plaintiff's systems (Evidence Item B)",
        "Network traffic captures (Evidence Item C)"
    ]
)

# Add methodology
report.add_methodology(
    standards="NIST SP 800-86, Scientific Working Group on Digital Evidence",
    tools=[
        "EnCase Forensic 8.11",
        "Volatility Framework 3.0",
        "Autopsy Digital Forensics Platform"
    ],
    procedures="""
    All analysis was conducted on forensically sound copies of the original
    evidence. Hash values were verified before and after analysis to ensure
    integrity. Industry-standard forensic procedures were followed throughout.
    """
)

# Add findings
report.add_finding(
    finding_number=1,
    title="Unauthorized Access Occurred",
    opinion="Certain",
    basis="""
    Based on my analysis of Evidence Items A and B, I determined with a
    reasonable degree of scientific certainty that the defendant's computer
    was used to access plaintiff's proprietary database on multiple occasions.
    """,
    supporting_evidence=[
        "Browser history showing access to plaintiff's internal URL",
        "Downloaded files matching plaintiff's proprietary documents",
        "Timestamps correlating with server access logs"
    ]
)

report.add_finding(
    finding_number=2,
    title="Evidence of Concealment",
    opinion="Highly Probable",
    basis="""
    My analysis revealed evidence of anti-forensic activity designed to
    conceal the unauthorized access, including deleted browser history
    and use of privacy tools.
    """,
    supporting_evidence=[
        "CCleaner execution artifacts found in prefetch",
        "Recovered deleted browser history entries",
        "Timestamps showing activity followed by cleanup"
    ]
)

# Add opinions
report.add_opinion("""
Based on my examination and analysis of the digital evidence, it is my
expert opinion that the defendant used their computer to access plaintiff's
proprietary information without authorization, and subsequently took steps
to conceal this activity.
""")

# Add appendices
report.add_appendix("Technical Analysis Details", "detailed_analysis.pdf")
report.add_appendix("Evidence Inventory", "evidence_list.xlsx")

# Generate report
report.generate()
report.export_pdf("/evidence/reports/expert_witness_report.pdf")

任务 4：事件响应报告

输入：IR 调查结果和采取的措施

流程：

1. 记录事件详情
2. 记录响应措施
3. 分析根本原因
4. 记录经验教训
5. 提出建议

输出：IR 文档

示例：

from forensic_reporting import IncidentResponseReport

# Initialize IR report
report = IncidentResponseReport(
    incident_id="INC-2024-0042",
    incident_name="Ransomware Attack - ACME Corporation"
)

# Set incident details
report.set_incident_details(
    detection_time="2024-01-10 10:30 UTC",
    declaration_time="2024-01-10 11:00 UTC",
    resolution_time="2024-01-12 16:00 UTC",
    severity="Critical",
    classification="Ransomware",
    affected_systems=["FILE-SERVER-01", "DB-SERVER-02", "25 workstations"],
    affected_users="Approximately 500 users"
)

# Add detection information
report.add_detection(
    detection_source="EDR Alert",
    initial_indicators=[
        "Multiple encryption processes detected",
        "Ransom note file creation",
        "Unusual SMB traffic patterns"
    ],
    first_responder="Jane Doe (SOC Analyst)"
)

# Add response timeline
report.add_response_action(
    timestamp="2024-01-10 11:15",
    action="Network isolation initiated",
    performed_by="Network Team",
    result="Affected servers isolated from network"
)

report.add_response_action(
    timestamp="2024-01-10 12:00",
    action="Forensic evidence collection started",
    performed_by="DFIR Team",
    result="Memory and disk images acquired"
)

report.add_response_action(
    timestamp="2024-01-10 18:00",
    action="Threat actor IOCs blocked at perimeter",
    performed_by="Security Team",
    result="C2 communications blocked"
)

report.add_response_action(
    timestamp="2024-01-11 09:00",
    action="Restoration from backups initiated",
    performed_by="IT Operations",
    result="Clean backups identified and restoration started"
)

# Add root cause analysis
report.add_root_cause_analysis(
    initial_access="Phishing email with malicious attachment",
    attack_vector="Macro-enabled Word document",
    vulnerabilities_exploited=[
        "Lack of email attachment sandboxing",
        "Macros enabled by default",
        "Insufficient network segmentation"
    ],
    timeline_summary="""
    The attacker sent a targeted phishing email to an employee, who opened
    the malicious attachment. The document macro downloaded and executed
    ransomware, which then spread via SMB to accessible file shares.
    """
)

# Add impact assessment
report.add_impact_assessment(
    business_impact="48 hours of partial business disruption",
    data_impact="No confirmed data exfiltration; files encrypted but restored",
    financial_impact="Estimated $250,000 (response, restoration, lost productivity)",
    reputational_impact="Minimal - no public disclosure required"
)

# Add lessons learned
report.add_lesson_learned(
    category="detection",
    lesson="Email gateway did not detect the malicious attachment",
    improvement="Implement advanced email threat protection with sandboxing"
)

report.add_lesson_learned(
    category="response",
    lesson="Network isolation took 45 minutes due to manual process",
    improvement="Implement automated isolation capabilities"
)

# Add recommendations
report.add_recommendation(
    priority="critical",
    recommendation="Disable macros by default enterprise-wide",
    timeline="Immediate"
)

report.add_recommendation(
    priority="high",
    recommendation="Implement network segmentation",
    timeline="30 days"
)

# Generate report
report.generate()
report.export_pdf("/evidence/reports/incident_report.pdf")

任务 5：IOC 报告

输入：提取的失陷指标

流程：

1. 按类型整理 IOC
2. 添加上下文和元数据
3. 整理格式以便共享
4. 生成阻止列表
5. 以标准格式导出

输出：IOC 文档和信息源

示例：

from forensic_reporting import IOCReportGenerator

# Initialize IOC report
report = IOCReportGenerator(
    case_id="CASE-2024-001",
    threat_name="Operation Shadow Strike",
    tlp="amber"
)

# Add network IOCs
report.add_network_ioc(
    type="ip",
    value="203.0.113.50",
    context="Command and control server",
    confidence="high",
    first_seen="2024-01-10",
    source="Memory forensics"
)

report.add_network_ioc(
    type="domain",
    value="evil-c2.example.com",
    context="C2 domain",
    confidence="high",
    first_seen="2024-01-10",
    source="DNS cache analysis"
)

report.add_network_ioc(
    type="url",
    value="https://evil-c2.example.com/beacon",
    context="Beacon download URL",
    confidence="high",
    first_seen="2024-01-10",
    source="Network forensics"
)

# Add file IOCs
report.add_file_ioc(
    type="hash_md5",
    value="d41d8cd98f00b204e9800998ecf8427e",
    filename="malware.exe",
    context="Primary malware sample",
    confidence="high",
    source="Disk forensics"
)

report.add_file_ioc(
    type="hash_sha256",
    value="e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    filename="malware.exe",
    context="Primary malware sample",
    confidence="high",
    source="Disk forensics"
)

# Add host IOCs
report.add_host_ioc(
    type="registry",
    value="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater",
    context="Persistence mechanism",
    confidence="high",
    source="Registry forensics"
)

report.add_host_ioc(
    type="mutex",
    value="Global\\MalwareMutex123",
    context="Malware mutex",
    confidence="high",
    source="Memory forensics"
)

report.add_host_ioc(
    type="filepath",
    value="C:\\Windows\\Temp\\beacon.exe",
    context="Malware drop location",
    confidence="high",
    source="Disk forensics"
)

# Add MITRE ATT&CK mapping
report.add_mitre_mapping("T1566.001", "Spearphishing Attachment")
report.add_mitre_mapping("T1059.001", "PowerShell")
report.add_mitre_mapping("T1547.001", "Registry Run Keys")
report.add_mitre_mapping("T1003.001", "LSASS Memory")

# Generate report
report.generate()

# Export in multiple formats
report.export_pdf("/evidence/reports/ioc_report.pdf")
report.export_csv("/evidence/reports/iocs.csv")
report.export_json("/evidence/reports/iocs.json")
report.export_stix("/evidence/reports/iocs.stix.json")
report.export_misp("/evidence/reports/misp_event.json")

# Generate blocklists
report.export_ip_blocklist("/evidence/reports/block_ips.txt")
report.export_domain_blocklist("/evidence/reports/block_domains.txt")
report.export_hash_blocklist("/evidence/reports/block_hashes.txt")

任务 6：证据保管链报告

输入：证据处理记录

流程：

1. 记录证据项目
2. 记录所有移交
3. 跟踪访问事件
4. 验证完整性
5. 生成法律文档

输出：证据保管链文档

示例：

from forensic_reporting import ChainOfCustodyReport

# Initialize chain of custody report
report = ChainOfCustodyReport(
    case_id="CASE-2024-001",
    case_name="Corporate Investigation"
)

# Add evidence items
report.add_evidence_item(
    item_number="EVD-001",
    description="Dell Latitude 5520 Laptop",
    serial_number="ABC123XYZ",
    collected_by="John Doe",
    collected_date="2024-01-15 10:00",
    collected_location="Employee desk, Building A, Floor 3",
    initial_condition="Powered on, user logged in",
    storage_location="Evidence locker, Room 101"
)

report.add_evidence_item(
    item_number="EVD-002",
    description="Forensic image of EVD-001",
    hash_md5="abc123...",
    hash_sha256="def456...",
    created_by="Jane Smith",
    created_date="2024-01-15 14:00",
    tool_used="FTK Imager 4.7",
    storage_location="Evidence server, /cases/2024-001/"
)

# Record custody transfers
report.add_custody_transfer(
    item_number="EVD-001",
    transfer_date="2024-01-15 11:00",
    from_person="John Doe",
    from_location="Building A, Floor 3",
    to_person="Jane Smith",
    to_location="Forensics Lab, Room 201",
    purpose="Forensic imaging",
    transport_method="Hand-carried in evidence bag"
)

report.add_custody_transfer(
    item_number="EVD-001",
    transfer_date="2024-01-15 16:00",
    from_person="Jane Smith",
    from_location="Forensics Lab, Room 201",
    to_person="Evidence Custodian",
    to_location="Evidence Locker, Room 101",
    purpose="Secure storage",
    transport_method="Hand-carried in evidence bag"
)

# Record evidence access
report.add_access_record(
    item_number="EVD-002",
    access_date="2024-01-16 09:00",
    accessed_by="Jane Smith",
    purpose="Forensic analysis",
    actions="Mounted read-only, analyzed with Autopsy",
    duration="4 hours"
)

# Add verification records
report.add_verification(
    item_number="EVD-002",
    verification_date="2024-01-20",
    verified_by="Jane Smith",
    hash_verified=True,
    notes="Hash matches original acquisition"
)

# Generate report
report.generate()
report.export_pdf("/evidence/reports/chain_of_custody.pdf")

任务 7：时间线报告

输入：取证时间线数据

流程：

1. 导入时间线事件
2. 添加叙述性背景
3. 突出关键事件
4. 创建可视化内容
5. 生成报告

输出：以时间线为重点的报告

示例：

from forensic_reporting import TimelineReportGenerator

# Initialize timeline report
report = TimelineReportGenerator(
    case_id="CASE-2024-001",
    title="Attack Timeline Analysis"
)

# Import timeline data
report.import_timeline("/evidence/timeline/supertimeline.csv")

# Add narrative sections
report.add_narrative_section(
    title="Initial Access",
    time_range=("2024-01-10 10:30", "2024-01-10 10:35"),
    narrative="""
    The attack began when a user opened a malicious email attachment.
    The document contained a macro that executed PowerShell commands
    to download the primary payload.
    """,
    highlight_events=[
        "2024-01-10 10:31 - Document opened",
        "2024-01-10 10:32 - PowerShell executed",
        "2024-01-10 10:33 - Payload downloaded"
    ]
)

report.add_narrative_section(
    title="Lateral Movement",
    time_range=("2024-01-10 14:00", "2024-01-10 15:00"),
    narrative="""
    After establishing persistence, the attacker performed credential
    dumping and began moving laterally through the network.
    """,
    highlight_events=[
        "2024-01-10 14:15 - Mimikatz execution",
        "2024-01-10 14:30 - RDP to FILE-SERVER-01"
    ]
)

# Add key events
report.add_key_event(
    timestamp="2024-01-10 10:31",
    event="Initial Compromise",
    description="User opened malicious attachment",
    significance="Attack initiation point"
)

report.add_key_event(
    timestamp="2024-01-10 14:15",
    event="Credential Theft",
    description="Mimikatz executed to dump credentials",
    significance="Enabled lateral movement"
)

# Configure visualization
report.configure_visualization(
    show_gaps=True,
    highlight_anomalies=True,
    group_by="source"
)

# Generate report
report.generate()
report.export_pdf("/evidence/reports/timeline_report.pdf")
report.export_html("/evidence/reports/timeline_report.html")

任务 8：合规报告

输入：用于合规审查的调查结果

流程：

1. 映射到合规框架
2. 记录必需内容
3. 评估合规影响
4. 生成通知
5. 创建审计跟踪记录

输出：符合合规要求的文档

示例：

from forensic_reporting import ComplianceReportGenerator

# Initialize compliance report
report = ComplianceReportGenerator(
    case_id="CASE-2024-001",
    frameworks=["GDPR", "PCI-DSS", "HIPAA"]
)

# Add incident details
report.set_incident_details(
    incident_type="data_breach",
    detection_date="2024-01-10",
    affected_records=1500,
    data_types=["PII", "Financial data"],
    geographic_scope=["EU", "US"]
)

# GDPR compliance
report.add_gdpr_assessment(
    personal_data_affected=True,
    data_subjects=["Employees", "Customers"],
    dpa_notification_required=True,
    dpa_notification_deadline="2024-01-13",
    subject_notification_required=True,
    risk_to_subjects="High - credential theft"
)

# PCI-DSS compliance
report.add_pci_assessment(
    cardholder_data_affected=False,
    requirement_violations=["Req 10 - Logging", "Req 11 - Testing"],
    forensic_investigation_required=True
)

# Generate compliance timeline
report.add_compliance_action(
    framework="GDPR",
    action="DPA Notification Sent",
    date="2024-01-12",
    details="Notification sent to ICO within 72 hours"
)

report.add_compliance_action(
    framework="GDPR",
    action="Data Subject Notification",
    date="2024-01-15",
    details="Email notification sent to affected individuals"
)

# Generate notifications
report.generate_dpa_notification(
    authority="ICO",
    output_path="/evidence/reports/ico_notification.pdf"
)

report.generate_subject_notification(
    template="breach_notification",
    output_path="/evidence/reports/subject_notification.pdf"
)

# Generate compliance report
report.generate()
report.export_pdf("/evidence/reports/compliance_report.pdf")

任务 9：报告模板

输入：模板要求

流程：

1. 创建模板结构
2. 定义占位符
3. 添加样式
4. 测试生成效果
5. 导出模板

输出：可重复使用的报告模板

示例：

from forensic_reporting import ReportTemplateManager

# Initialize template manager
templates = ReportTemplateManager()

# Create custom template
template = templates.create_template(
    name="malware_analysis",
    title="Malware Analysis Report",
    sections=[
        {
            "name": "executive_summary",
            "title": "Executive Summary",
            "required": True
        },
        {
            "name": "sample_information",
            "title": "Sample Information",
            "fields": ["filename", "hash_md5", "hash_sha256", "file_size", "file_type"]
        },
        {
            "name": "static_analysis",
            "title": "Static Analysis",
            "subsections": ["pe_analysis", "strings", "imports", "resources"]
        },
        {
            "name": "dynamic_analysis",
            "title": "Dynamic Analysis",
            "subsections": ["behavior", "network", "file_system", "registry"]
        },
        {
            "name": "iocs",
            "title": "Indicators of Compromise",
            "fields": ["network_iocs", "file_iocs", "host_iocs"]
        },
        {
            "name": "mitre_mapping",
            "title": "MITRE ATT&CK Mapping"
        },
        {
            "name": "conclusions",
            "title": "Conclusions and Recommendations"
        }
    ]
)

# Set template styling
template.set_styling(
    font="Arial",
    header_color="#003366",
    table_style="professional"
)

# Save template
templates.save_template(template, "/templates/malware_analysis.json")

# List available templates
available = templates.list_templates()
for t in available:
    print(f"Template: {t.name}")
    print(f"  Sections: {len(t.sections)}")

# Generate report from template
report = templates.generate_from_template(
    template_name="malware_analysis",
    data={
        "filename": "malware.exe",
        "hash_sha256": "abc123...",
        "executive_summary": "Analysis of malware sample...",
        "iocs": {...}
    }
)
report.export_pdf("/evidence/reports/malware_report.pdf")

任务 10：多格式导出

输入：报告内容

流程：

1. 针对格式准备内容
2. 应用格式设置
3. 包含附件
4. 生成输出
5. 验证输出

输出：多种格式的报告

示例：

from forensic_reporting import MultiFormatExporter

# Initialize exporter with report content
exporter = MultiFormatExporter(
    report_data="/evidence/reports/report_data.json"
)

# Export to PDF with options
exporter.export_pdf(
    output_path="/evidence/reports/report.pdf",
    options={
        "include_toc": True,
        "include_appendices": True,
        "watermark": "CONFIDENTIAL",
        "password_protect": True,
        "password": "SecurePassword123"
    }
)

# Export to Word
exporter.export_docx(
    output_path="/evidence/reports/report.docx",
    options={
        "template": "/templates/corporate.docx",
        "include_styles": True,
        "track_changes": False
    }
)

# Export to HTML
exporter.export_html(
    output_path="/evidence/reports/report.html",
    options={
        "include_navigation": True,
        "interactive_timeline": True,
        "responsive": True
    }
)

# Export to Markdown
exporter.export_markdown(
    output_path="/evidence/reports/report.md",
    options={
        "github_flavored": True,
        "include_toc": True
    }
)

# Export to PowerPoint
exporter.export_pptx(
    output_path="/evidence/reports/presentation.pptx",
    options={
        "template": "/templates/corporate.pptx",
        "include_speaker_notes": True
    }
)

# Batch export
exporter.batch_export(
    output_dir="/evidence/reports/",
    formats=["pdf", "docx", "html", "md"],
    naming_pattern="{case_id}_{date}_{format}"
)

配置

环境变量

变量	描述	必需	默认值
REPORT_TEMPLATE_DIR	报告模板目录	否	./templates
REPORT_OUTPUT_DIR	默认输出目录	否	./reports
ORGANIZATION_NAME	页眉中显示的组织名称	否	None
LOGO_PATH	组织徽标的路径	否	None

选项

选项	类型	描述
include_toc	boolean	包含目录
include_appendices	boolean	包含附录
watermark	string	添加水印文本
classification	string	文档密级
template	string	要使用的模板

示例

示例 1：完整调查报告

场景：生成完整的报告包

from forensic_reporting import ReportPackageGenerator

# Create complete report package
package = ReportPackageGenerator(case_id="CASE-2024-001")

# Add all report types
package.add_technical_report(findings_data)
package.add_executive_summary(summary_data)
package.add_ioc_report(iocs)
package.add_timeline_report(timeline)
package.add_chain_of_custody(custody_records)

# Generate all reports
package.generate_all("/evidence/reports/")

# Create final package
package.create_package(
    output_path="/evidence/CASE-2024-001_Final_Report_Package.zip"
)

局限性

• 复杂格式在不同导出格式中的呈现可能有所不同
• 大型报告可能需要较长时间生成
• 某些功能需要安装特定字体
• 模板自定义存在限制
• 交互功能仅支持 HTML 导出
• 密码保护因格式而异
• 不保证符合法律规定

故障排除

常见问题 1：找不到字体

问题：由于缺少字体，报告生成失败 解决方案：

• 安装所需字体
• 使用备用字体选项
• 使用内置字体

常见问题 2：大型报告超时

问题：报告生成耗时过长 解决方案：

• 分别生成各个章节
• 降低图像质量
• 使用更轻量的模板

常见问题 3：格式转换问题

问题：内容在不同格式中的显示效果不同 解决方案：

• 使用适合目标格式的样式
• 在目标格式中进行测试
• 简化复杂格式

相关技能

• artifact-collection：证据文档编制
• timeline-forensics：时间线生成
• malware-forensics：IOC 提取
• memory-forensics：技术发现
• disk-forensics：技术发现

参考资料

• 取证报告参考
• 报告模板指南
• 法律文档标准